Do not train on a label and a checksum.
A shared dataset looks plausible, but one label was altered. Before training, the model builder needs exact bytes, signed source and transformation claims, required content profiles, an authorized handoff, and an independent expectation of what should arrive.
The admission decision
| Check | Training gate |
|---|---|
| Origin and transformations | Every head traces through exact predecessor bindings to an accepted source claim. |
| Signer authorization | Each key is allowed for the source, operation, profile, or handoff role it signed. |
| Required profiles | Labels, schema, allowed values, identifier rules, and other organization-specific constraints pass. |
| Handoff completeness and freshness | The expected manifest or head matches the signed graph presented for this training run. |
| Received bytes | The actual dataset or dataset manifest matches the signed artifact binding. |
A valid gate is not a quality score
The verifier can establish that exact bytes match authorized signed claims and required schemas. It cannot prove the labels are correct, the dataset is unbiased, or the model will be safe. Those require separate evaluation evidence and policy.
Concrete training gate
| Input | A received dataset bundle, receiver trust policy, local schema catalog, expected head or manifest, and expected artifact binding. |
|---|---|
| Gate | Run complete bundle verification before enqueueing the training job. |
| Allow | All required checks pass and the report decision is allow. |
| Deny | A validly re-signed dataset that reintroduces a direct identifier fails the receiver's private artifact profile with E_PROFILE_INVALID. |